GCVE Workshop - 22 September 2026 (14:00-18:00), Luxembourg Before The Vulnopticon Conference - Registration

FKIE_CVE-2026-89498

Vulnerability from fkie_nvd - Published: 2026-09-11 20:19 - Updated: 2026-09-14 13:19
Severity
Summary
In the Linux kernel, the following vulnerability has been resolved: orangefs: fix double-free of trailer_buf on readdir copy failure On a readdir downcall, orangefs_devreq_write_iter() frees op->downcall.trailer_buf with vfree() when copy_from_iter_full() fails, but does not clear the pointer before goto Efault. The waiter in do_readdir() is then woken with a negative status and frees the same pointer again on its r < 0 path, causing a deterministic double-free. A client holding /dev/pvfs2-req triggers it by sending a readdir downcall whose declared trailer_size exceeds the bytes it supplies. Clear the pointer after freeing so the readdir-side vfree() becomes a no-op.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/2f5454a25127854c232fde5d1d65d16fbcd42d43
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/433c2e470053cc9c712314d3d8c3dfbc862d68eb
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/519f4146b8b8c5f20c2ad01913acd6df2df8fc8e
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/6e5924644ef4bce06a3cbb7cb841a8bbfdfc03ad
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/712c4235fcc73c11a2f1d59a499d489e49c374a4
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/9c9eacc47c618ed6d7d35fe75a40d294c8cdbffa
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f574296be7f46eb60beca851240b526df232f480
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/f796f38a324e89547738f4b70cc33be5be2bc6da
Impacted products
Vendor Product Version
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "fs/orangefs/devorangefs-req.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "712c4235fcc73c11a2f1d59a499d489e49c374a4",
              "status": "affected",
              "version": "382f4581e67f57209c7aa67e39f26ba076306a2e",
              "versionType": "git"
            },
            {
              "lessThan": "433c2e470053cc9c712314d3d8c3dfbc862d68eb",
              "status": "affected",
              "version": "382f4581e67f57209c7aa67e39f26ba076306a2e",
              "versionType": "git"
            },
            {
              "lessThan": "6e5924644ef4bce06a3cbb7cb841a8bbfdfc03ad",
              "status": "affected",
              "version": "382f4581e67f57209c7aa67e39f26ba076306a2e",
              "versionType": "git"
            },
            {
              "lessThan": "9c9eacc47c618ed6d7d35fe75a40d294c8cdbffa",
              "status": "affected",
              "version": "382f4581e67f57209c7aa67e39f26ba076306a2e",
              "versionType": "git"
            },
            {
              "lessThan": "2f5454a25127854c232fde5d1d65d16fbcd42d43",
              "status": "affected",
              "version": "382f4581e67f57209c7aa67e39f26ba076306a2e",
              "versionType": "git"
            },
            {
              "lessThan": "f796f38a324e89547738f4b70cc33be5be2bc6da",
              "status": "affected",
              "version": "382f4581e67f57209c7aa67e39f26ba076306a2e",
              "versionType": "git"
            },
            {
              "lessThan": "519f4146b8b8c5f20c2ad01913acd6df2df8fc8e",
              "status": "affected",
              "version": "382f4581e67f57209c7aa67e39f26ba076306a2e",
              "versionType": "git"
            },
            {
              "lessThan": "f574296be7f46eb60beca851240b526df232f480",
              "status": "affected",
              "version": "382f4581e67f57209c7aa67e39f26ba076306a2e",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "fs/orangefs/devorangefs-req.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "4.12"
            },
            {
              "lessThan": "4.12",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.270",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.221",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.1.*",
              "status": "unaffected",
              "version": "6.1.188",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.6.*",
              "status": "unaffected",
              "version": "6.6.157",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.12.*",
              "status": "unaffected",
              "version": "6.12.109",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "6.18.*",
              "status": "unaffected",
              "version": "6.18.50",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "7.2.*",
              "status": "unaffected",
              "version": "7.2.4",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "7.3-rc1",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\norangefs: fix double-free of trailer_buf on readdir copy failure\n\nOn a readdir downcall, orangefs_devreq_write_iter() frees\nop-\u003edowncall.trailer_buf with vfree() when copy_from_iter_full() fails,\nbut does not clear the pointer before goto Efault. The waiter in\ndo_readdir() is then woken with a negative status and frees the same\npointer again on its r \u003c 0 path, causing a deterministic double-free.\nA client holding /dev/pvfs2-req triggers it by sending a readdir\ndowncall whose declared trailer_size exceeds the bytes it supplies.\n\nClear the pointer after freeing so the readdir-side vfree() becomes a\nno-op."
    }
  ],
  "id": "CVE-2026-89498",
  "lastModified": "2026-09-14T13:19:07.087",
  "metrics": {},
  "published": "2026-09-11T20:19:31.940",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/2f5454a25127854c232fde5d1d65d16fbcd42d43"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/433c2e470053cc9c712314d3d8c3dfbc862d68eb"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/519f4146b8b8c5f20c2ad01913acd6df2df8fc8e"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/6e5924644ef4bce06a3cbb7cb841a8bbfdfc03ad"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/712c4235fcc73c11a2f1d59a499d489e49c374a4"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/9c9eacc47c618ed6d7d35fe75a40d294c8cdbffa"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/f574296be7f46eb60beca851240b526df232f480"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/f796f38a324e89547738f4b70cc33be5be2bc6da"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.